CVE-2026-89653

Received Received - Intake

Path Traversal in Linux Kernel CephFS

Publication date: 2026-09-11

Last updated on: 2026-09-14

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: ceph: reject export_targets ranks >= CEPH_MAX_MDS in mdsmap decode MDSMap export_targets entries are monitor controlled. check_new_map() uses each entry as a bit number in a fixed stack bitmap, so a rank outside the protocol namespace can make set_bit() write past the end of the array. Reject ranks outside CEPH_MAX_MDS while decoding the map. Do not validate against possible_max_rank here because maps may legitimately reference ranks beyond a temporarily reduced max_mds.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-11

Last Modified

2026-09-14

Generated

2026-10-02

AI Q&A

2026-09-12

EPSS Evaluated

2026-10-01

NVD

CVE-2026-89653

EUVD

EUVD-2026-76565

Affected Vendors & Products

Vendor	Product	Version / Range
ceph	ceph	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability in the Linux kernel involves the Ceph distributed file system. It occurs during the decoding of the MDSMap, which contains metadata about the metadata servers. The issue arises when export_targets ranks in the MDSMap are greater than or equal to CEPH_MAX_MDS. This can cause set_bit() to write past the end of a fixed stack bitmap, leading to potential memory corruption or crashes.

Detection Guidance

This vulnerability is specific to the Linux kernel's Ceph filesystem component. Detection requires checking if your system is running a vulnerable kernel version with Ceph enabled. Examine kernel logs for MDS map decoding errors or monitor logs for invalid export_targets entries. No specific commands are provided in the context.

Impact Analysis

If exploited, this vulnerability could allow an attacker to cause a denial of service by crashing the system or trigger undefined behavior, including potential privilege escalation. Systems running affected versions of the Linux kernel with Ceph enabled are at risk.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards as it is a Linux kernel issue specific to the Ceph distributed file system. Compliance impacts would depend on system configuration and usage rather than this vulnerability itself.

Mitigation Strategies

Update your Linux kernel to the latest patched version that resolves this issue. If using Ceph, ensure your MDS maps do not contain export_targets ranks >= CEPH_MAX_MDS. Monitor Ceph cluster health and logs for any signs of exploitation attempts.

Hi! I’m here to help you understand CVE-2026-89653. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70